IIA Internal Audit Practitioner Sample Questions:

1. Which of the following best explains why internal auditors should identify risk scenarios during a risk assessment of the area being audited?

A) To determine what would prevent the achievement of objectives in the area being audited.
B) To evaluate the adequacy of management's risk management process in the area being audited.
C) To determine whether established controls are operating effectively to mitigate critical risks.

2. An internal auditor was gathering information regarding the receiving process and decided that a narrative memorandum was the best way to document the process. Which of the following explanations best supports the auditor's decision?

A) The process is simple and does not need a visual depiction
B) The audit engagement is not considering efficiency
C) The department has comprehensive manuals

3. During an accounts payable audit engagement, the internal auditor found that vendor invoices are always paid
30 days after the invoice date, regardless of the vendor's payment terms. The auditor also discovered that accounts payable employees are not comparing vendor invoices received to previous vendor invoices prior to payment. Based on the auditor's observations, what are the potential risks?

A) Poor cash management due to potentially paying the wrong vendors
B) Poor cash management due to potentially paying fraudulent invoices
C) Poor cash management due to potentially lost payment discounts

4. Which of the following best describes the difference between inherent risk and residual risk?

A) Inherent risk is the level of risk the organization is willing to accept, residual risk is the level of risk deemed unacceptable by the organization.
B) Inherent risk is the level of risk before the risk assessment process, residual risk is the level of risk remaining after completing the risk assessment process.
C) Inherent risk is the level of risk in the absence of any targeted actions or controls to alter its severity, residual risk is the risk remaining after implementing corrective actions.

5. An internal auditor is planning a business continuity audit engagement at a remote manufacturing plant. During planning interviews, the plant manager stated that the local Environmental, Health, and Safety (EHS) Department, which reports to the plant manager, had completed a similar review six months ago. The EHS review did not find any significant weaknesses. How should the internal auditor consider the EHS review results in the current audit engagement planning?

A) Recommend canceling the audit engagement, as it would be a duplication of effort to revisit the same process already reviewed by EHS.
B) Ignore the EHS review results, as the department is not a reliable source of information due to its lack of objectivity and independence.
C) Evaluate the objectivity and competency of the EHS reviewers and their work to determine whether their review results may be relied upon.

Solutions: